Detection Rule 2

Conditions

According to the VMware OUI allocation scheme, a MAC address has the format of 00:50:56:XX:YY:ZZ, where 00:50:56 represents the VMware OUI, XX is calculated as (80 + vCenter Server ID), and YY and ZZ are random two-digit hexadecimal numbers.

Tested on

Detection Rule 3

Conditions

According to the VMware OUI allocation scheme, the hypervisor generates MAC addresses that consists of the VMware OUI 00:0C:29 and the last three octets of the virtual machine UUID in hexadecimal format. The virtual machine UUID is based on a hash calculated by using the UUID of the ESXi physical machine and the path to the configuration file (.vmx) of the virtual machine.

Tested on

Detection Rule 4

Conditions

According to the VMware OUI allocation scheme, the hypervisor generates MAC addresses that consists of the VMware OUI 00:05:69 and the last three octets generated by the following algorithm:

The first 16 bits are set to the same values as the last 16 bits of the console operating system’s primary IP address.

The final eight bits of the MAC address are set to a hash value based on the name of the virtual machine’s configuration file.

For example, if a machine's IP address was 192.34.14.81 (or in hex, 0xc0220e51) and the configuration file was hashed to the value of 95, the MAC address would have the following value: 00:05:69:0e:51:95

More questions

Have questions?

We work hard to improve our services for you. As part of that process we welcome your feedback, questions
and suggestions. Please let us know your thoughts and feelings, and any way in which you think we can
improve our product.